Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG][Dart] Basic and Bearer auth interceptors case-sensitive scheme comparison #17073

Open
5 of 6 tasks
karadzhov opened this issue Nov 14, 2023 · 0 comments
Open
5 of 6 tasks

Comments

@karadzhov
Copy link
Contributor

karadzhov commented Nov 14, 2023

Bug Report Checklist

  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • Have you tested with the latest master to confirm the issue still exists?
  • Have you searched for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Sponsorship to speed up the bug fix or feature request (example)
Description

The OpenAPI specification defines the "scheme" property as:

The name of the HTTP Authorization scheme to be used in the Authorization header as defined in RFC7235. The values used SHOULD be registered in the IANA Authentication Scheme registry.

According to RFC7235 the name of the HTTP Authorization scheme must be a case-insensitive token:

It uses a case-insensitive token as a means to identify the authentication scheme, followed by additional information necessary for achieving authentication via that scheme.

RFC7617 - Basic Auth also agrees that the scheme must be a case-insensitive token:

Note that both scheme and parameter names are matched case-insensitively.

RFC6750 - Bearer Auth is contradicting because:

Unless otherwise noted, all the protocol parameter names and values are case sensitive.

and it also defines it as "Bearer".

The BasicAuthInterceptor and BearerAuthInterceptor only compare with "basic" and "bearer" which is against the specification and does not work for example when the OpenAPI specification was generated by Smithy.

openapi-generator version

openapi-generator-cli-7.0.1.jar

OpenAPI declaration file content or url
{
  "openapi": "3.0.2",
  "info": {
    "title": "Sample",
    "version": "1.0.0"
  },
  "paths": {
    "/hello": {
      "get": {
        "operationId": "Hello",
        "parameters": [
          {
            "name": "Name",
            "in": "query",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Hello 200 response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "greeting": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Name": {
        "type": "string"
      },
      "HelloResponseContent": {
        "type": "object",
        "properties": {
          "greeting": {
            "type": "string"
          }
        }
      }
    },
    "securitySchemes": {
      "smithy.api.httpBearerAuth": {
        "type": "http",
        "description": "HTTP Bearer authentication",
        "scheme": "Bearer"
      }
    }
  },
  "security": [
    {
      "smithy.api.httpBearerAuth": []
    }
  ]
}
Generation Details
Steps to reproduce
Related issues/PRs
Suggest a fix

In order to compare the strings in a case-insensitive manner, make sure that both values are in lowercase.

@karadzhov karadzhov changed the title [BUG][Dart] Basic and Bearer auth interceptors incorrect scheme string value case [BUG][Dart] Basic and Bearer auth interceptors case-sensitive string comparison Nov 14, 2023
@karadzhov karadzhov changed the title [BUG][Dart] Basic and Bearer auth interceptors case-sensitive string comparison [BUG][Dart] Basic and Bearer auth interceptors case-sensitive scheme comparison Nov 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant